PT-2026-125464
CVE-2026-116586
·
Published
2026-10-26
·
Updated
2026-10-26
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
go-jose versions prior to 4.1.5
Description
Parsing attacker-controlled JSON allows deeply nested arrays or objects to exceed the stack limit of the Go language. This results in a stack overflow, which crashes the application and enables a denial of service.
Recommendations
Update go-jose to version 4.1.5.
Found an issue in the description? Have something to add? Feel free to write us 👾